StoryFox

Privacy Policy

Our privacy policy and how we use your data

Effective date: November 1, 2025

This Privacy Policy explains what personal information StoryFox collects, why we collect it, who we share it with, and the choices you have. StoryFox is operated by Marouane Daoudi, a sole proprietor doing business as StoryFox (“StoryFox,” “we,” “us”). You can reach us at hello@storyfox.net.

1. A quick summary

  • StoryFox is used by parents on behalf of their children. We do not create accounts for children directly.
  • We collect only what we need to generate stories, narrate them, and bill your subscription.
  • We do not sell personal data. We do not use your inputs or generated outputs to train AI models, and our AI partners are contractually prohibited from doing so.
  • You can delete any child profile, voice clone, photo, or your entire account at any time from your account settings, or by emailing us.

2. Information we collect

2.1 Information you give us

  • Account data: name, email address, and password (stored hashed) when you sign up.
  • Child profiles:the child's first name (or nickname), age, interests, and an optional photo, all entered by you. The photo is used to personalize illustrations.
  • Voice samples (Premium/Ultra): a short audio recording you upload so we can create a cloned voice through our partner Cartesia.
  • Payment information: handled entirely by Stripe. We never see your full card number; we only see a tokenized reference, the last four digits, and the brand of the card.
  • Support correspondence: messages you send us by email or through the contact form.

2.2 Information we collect automatically

  • Usage data: which features you use, how often you generate stories, error logs.
  • Device and connection: browser type, IP address, approximate location derived from IP, timestamps.
  • Cookies and similar: see our Cookie Policy.

3. How we use information

  • To generate personalized stories, illustrations, and narration for your child.
  • To create and manage cloned voices when you opt in.
  • To process payments, manage your subscription, and prevent fraud.
  • To send service emails (welcome, story ready, subscription confirmation, trial ending). We do not send marketing email unless you opt in.
  • To respond to support requests, comply with legal obligations, and enforce our Terms.
  • To monitor and improve the Service, detect abuse, and debug errors.

4. Who we share information with

We share data only with the third parties needed to run the Service. Each is bound by a data-processing agreement that limits use of your data to providing services to us.

  • OpenAI— generates story text, illustrations, and default narration audio. Inputs and outputs are not used to train models.
  • Cartesia— creates and stores cloned voices for Premium/Ultra users and synthesizes audio from those voices. Voice samples are deleted from Cartesia when you delete the voice.
  • Stripe— processes payments and stores payment-method details. See Stripe's privacy policy.
  • Supabase— database and authentication provider; hosts your account data, child profiles, and generated assets.
  • Vercel— serves the StoryFox web application and processes incoming web requests.
  • Resend— sends transactional emails.

We may also disclose information if required by law, valid legal process, or to protect the rights, safety, or property of StoryFox, our users, or the public.

We do not sell or rent personal information.

5. Children's data

StoryFox is designed to be operated by a parent or legal guardian on behalf of a child. We do not knowingly collect personal information directly from children under 13, and accounts are restricted to users 18 and older.

When a parent creates a child profile, the information stored is provided by the parent and used only to personalize stories for that child. We treat child profile data, including photos and voice samples that reflect a child's voice, with extra care:

  • Access is restricted to the parent who created the profile.
  • Photos and audio are stored encrypted at rest and transmitted over TLS.
  • We will never use a child's photo or voice for advertising or display outside the parent's own account.
  • You can delete a child profile, voice clone, or photo from the dashboard at any time, and it will be removed from our systems and our AI partners' systems within 30 days.

If you believe a child under 13 has had personal information collected without parental consent, email hello@storyfox.net and we will delete it.

6. Your rights

Depending on where you live, you may have rights to access, correct, delete, export, or restrict our use of your personal information, and to object to certain processing. Specifically:

  • GDPR (EEA, UK, Switzerland): rights of access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with your supervisory authority.
  • CCPA/CPRA (California):right to know, delete, correct, and opt-out of “sale” or “sharing” of personal information. As noted, we do not sell or share for cross-context behavioral advertising.

To exercise any of these rights, use the controls in your account settings or email hello@storyfox.net. We will respond within 30 days. We may ask you to verify your identity before acting on a request.

7. Data retention

  • Account data is kept while your account is active. When you close your account, we delete it within 30 days, except for records we must keep for tax, billing, or legal reasons.
  • Generated stories and illustrations are kept while your account is active so you can revisit them. You can delete individual stories at any time.
  • Voice clones are deleted from Cartesia within 30 days of you deleting the clone or closing your account.
  • Photos uploaded for child profiles are deleted when you delete the child profile or your account.
  • Logs with personally identifiable information are retained for up to 90 days for security and debugging.

8. International transfers

StoryFox is operated from the United States. If you use the Service from outside the US, your information will be transferred to, processed, and stored in the US and other countries where we or our service providers operate. Where required, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) for cross- border transfers of EEA, UK, and Swiss personal data.

9. Security

We use industry-standard measures to protect your data: TLS in transit, encryption at rest for sensitive fields and stored media, scoped database access with row-level security, hashed passwords, and audit logs. No system is perfectly secure, however. If we discover a breach affecting your data, we will notify you and the relevant authorities as required by law.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email or through the Service before the change takes effect. The “Effective date” at the top of this page indicates when it was last revised.

11. Contact

Privacy questions, deletion requests, or anything else: hello@storyfox.net.